AWS Identity Center

Use AWS IAM Identity Center to assign or revoke permission sets for AWS accounts, resolve users and groups, and inspect account access.

The same operations support the reverse direction — access review. Starting from an account, an agent can list its assignments, resolve the principals, expand groups into their members, and produce a written report of exactly who can reach that account and through which permission set.

One detail shapes how that review has to be built. AWS requires a permission set ARN alongside the account ID on this call, so List Assignments For Account returns only the assignments granted through that one permission set — not every assignment on the account. To cover an account completely, run List Permission Sets for the instance first, then call List Assignments For Account once per permission set and combine the results. Skipping that loop silently omits access granted through the permission sets you did not ask about.

Two AWS behaviors are worth knowing. Creating and deleting an account assignment are asynchronous: both return a request ID, and each has its own status poller — use Check Assignment Status for creations and Check Assignment Deletion Status for deletions, as the two request-ID types are not interchangeable. And the account-listing operations call AWS Organizations, which is global per partition; the block resolves the correct endpoint for commercial, GovCloud, and China regions automatically.

Usage Instructions

Provision and revoke temporary access to AWS accounts via IAM Identity Center (SSO). Assign permission sets to users or groups, look up users by email, and list accounts and permission sets for access request workflows.

Actions

Identity Center List Instances

List all AWS IAM Identity Center instances in your account

Input

Output

Identity Center List Accounts

List all AWS accounts in your organization

Input

Output

Identity Center Describe Account

Retrieve details about a specific AWS account by its ID

Input

Output

Identity Center List Permission Sets

List all permission sets defined in an IAM Identity Center instance

Input

Output

Identity Center Get User

Look up a user in the Identity Store by email address

Input

Output

Identity Center Describe User

Resolve an Identity Store user ID to the user behind it. Use to turn the principalId on an account assignment into a name and email.

Input

Output

Identity Center Get Group

Look up a group in the Identity Store by display name

Input

Output

Identity Center Describe Group

Resolve an Identity Store group ID to the group behind it. Use to turn the principalId on an account assignment into a group name.

Input

Output

Identity Center List Groups

List all groups in the Identity Store

Input

Output

Identity Center List Group Memberships

List the users who belong to an Identity Store group

Input

Output

Identity Center Create Account Assignment

Grant a user or group access to an AWS account via a permission set (temporary elevated access)

Input

Output

Identity Center Delete Account Assignment

Revoke a user or group access to an AWS account by removing a permission set assignment

Input

Output

Identity Center Check Assignment Status

Check the provisioning status of an account assignment creation request

Input

Output

Identity Center Check Assignment Deletion Status

Check the deprovisioning status of an account assignment deletion request

Input

Output

Identity Center List Account Assignments For Principal

List every account and permission set a specific user or group is assigned. Use List Assignments For Account to go the other way, from an account to its principals.

Input

Output

Identity Center List Assignments For Account

List every principal assigned a specific permission set on a specific AWS account. Use for per-account access reviews.

Input

Output